From 6a5d044dac6ccdac910072c41ef6250ce0e4eb0c Mon Sep 17 00:00:00 2001 From: teahubxyz Date: Wed, 14 Oct 2026 05:29:34 +0000 Subject: [PATCH] docs/decisions.md: v1 ledger seeded --- docs/decisions.md | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 docs/decisions.md diff --git a/docs/decisions.md b/docs/decisions.md new file mode 100644 index 0000000..2bb8a0e --- /dev/null +++ b/docs/decisions.md @@ -0,0 +1,21 @@ +# Decisions (append-only) + +Format: date · decision · why. Add at the bottom. Never edit an old entry; supersede it with a new one. + +## Standing rules +- Prod is the cloud instance at teahub.xyz. The Mac (hb-5) is the operator's playground and the archive of the old factory; prod never depends on it. +- No secrets on prod beyond: Gitea's own keys, the GitHub OAuth client, the MCP's OAuth client. Adding one is a decision. +- Every agent acts as itself (its own Gitea login). No service tokens. +- Port pieces from the old instance only when a card needs them, after reading them, one piece per commit, logged in docs/rebuild.md. + +## Ledger +- 2026-10-14 · **Green Tea v1 is a fresh prod, not a migration.** Nothing copied from hb-5 (no issues, labels, secrets, tokens). Why: the old factory was scaffolding; the rebuild is the portability test, and chai gets a box with no dev cruft. +- 2026-10-14 · **GitHub-backed Gitea on Fly.** Gitea stays (ownership, a place for chai to be admin); GitHub is upstream for Time and the first login. Why: Time is GitHub-native and already works; Gitea is cheap to run and keeps the sovereignty option. +- 2026-10-14 · **Logins: GitHub now, nostr next.** Auto-registration from GitHub; no local sign-up. Why: one click for collaborators; nostr gives agents and anyone else a key-based identity (see well-known.online). +- 2026-10-14 · **Tea MCP is off the Mac.** New Green Tea MCP on Fly, OAuth against prod Gitea, every tool as the caller. Why: the MCP is the product surface; it should be reachable without the operator's machine and must never outrun the caller's permissions. +- 2026-10-14 · **Boring stays on the Mac.** It is the operator's admin lane, not a prod component. Why: the thing that can repair prod and the thing that runs prod are different boxes with different owners. +- 2026-10-14 · **Codex is not installed on prod.** Seats are API-driven (Claude API, Venice); Codex on demand as a Fly Sprite. Why: no resident credentials on the runner. +- 2026-10-14 · **Fly cost accepted** for prod (two small apps). Same category as Venice credit. +- 2026-10-14 · **Mac runners reversed.** Last week's move of runners onto hb-5 is undone on purpose (portability exercise). +- 2026-10-14 · **Venture loop on teahubxyz/time paused** until the audit's remaining items are judged safe (3 criticals + 3 highs fixed in time#45, #46). +- 2026-10-14 · **well-known.online is a separate product**, not a Teahub component; may later be prod's signup front door. No dependency either way.